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Abstract 

This paper considers point to point secure communication over flat fading channels under an outage constraint. 
' More specifically, we extend the definition of outage capacity to account for the secrecy constraint and obtain sharp 

characterizations of the corresponding fundamental limits under two different assumptions on the transmitter CSI 
^ . (Channel state information). First, we find the outage secrecy capacity assuming that the transmitter has perfect 

, knowledge of the legitimate and eavesdropper channel gains. In this scenario, the capacity achieving scheme relies 

, on opportunistically exchanging private keys between the legitimate nodes. These keys are stored in a key buffer and 

later used to secure delay sensitive data using the Vemam's one time pad technique. We then extend our results to 
the more practical scenario where the transmitter is assumed to know only the legitimate channel gain. Here, our 
achievability arguments rely on privacy amplification techniques to generate secret key bits. In the two cases, we also 
characterize the optimal power control policies which, interestingly, turn out to be a judicious combination of channel 
inversion and the optimal ergodic strategy. Finally, we analyze the effect of key buffer overflow on the overall outage 
probability. 

■ I. Introduction 

t — 

, Secure communication is a topic that is becoming increasingly important thanks to the proliferation of wireless 

PsJ ■ devices. Over the years, several secrecy protocols have been developed and incorporated in several wireless standards; 

e.g., the IEEE 802.11 specifications for Wi-Fi. However, as new schemes are being developed, methods to counter 
the specific techniques also appear Breaking this cycle is critically dependent on the design of protocols that offer 
provable secrecy guarantees. The information theoretic secrecy paradigm adopted here, allows for a systematic 
j_j ■ approach for the design of low complexity and provable secrecy protocols that fully exploit the intrinsic properties 

of the wireless medium. 

Most of the recent work on information theoretic secrecy is, arguably, inspired by Wyner's wiretap channel (|2l. 
In this setup, a passive eavesdropper listens to the communication between two legitimate nodes over a separate 
communication channel. While attempting to decipher the message, no limit is imposed on the computational 
resources available to the eavesdropper This assumption led to defining perfect secrecy capacity as the maximum 
achievable rate subject to zero mutual information rate between the transmitted message and the signal received 
by the eavesdropper In the additive Gaussian noise scenario ||3|, the perfect secrecy capacity turned out to be 
the difference between the capacities of the legitimate and eavesdropper channels. Therefore, if the eavesdropper 
channel has a higher channel gain, information theoretic secure communication is not possible over the main 
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channel. Recent works have shown how to exploit multipath fading to avoid this limitation ID, ||5|, Q- The basic 
idea is to opportunistically exploit the instants when the main channel enjoys a higher gain than the eavesdropper 
channel to exchange secure messages. This opportunistic secrecy approach was shown to achieve non-zero ergodic 
secrecy capacity even when on average the eavesdropper channel has favorable conditions over the legitimate 
channel. Remarkably, this result still holds even when the channel state information of the eavesdropper channel is 
not available at the legitimate nodes. 

The ergodic result in ||4| applies only to delay tolerant traffic, e.g., file downloads. Early attempts at characterizing 
the delay limited secrecy capacity drew the negative conclusion that non-zero delay limited secrecy rates are not 
achievable, over almost all channel distributions, due to secrecy outage events corresponding to the instants when 
the eavesdropper channel gain is larger than the main one IS, JH). Later, it was shown in lfT4l that, interestingly, 
a non-zero delay limited secrecy rate could be achieved by introducing private key queues at both the transmitter 
and the receiver. These queues are used to store private key bits that are shared opportunistically between the 
legitimate nodes when the main channel is more favorable than the one seen by the eavesdropper. These key bits 
are used later to secure the delay sensitive data using the Vernam one time pad approach |[T]. Hence, secrecy 
outages are avoided by simply storing the secrecy generated previously, in the form of key bits, and using them 
whenever the channel conditions are more advantageous for the eavesdropper. However, this work stopped short of 
proving sharp capacity results or deriving the corresponding optimal power control policies. These results can be 
recovered as special cases of the secrecy outage capacity and power control characterization obtained in the sequel. 
In particular, this work investigates the outage secrecy capacity of point-to-point block fading channels. We first 
consider the scenario where perfect knowledge about the main and eavesdropper channels are available a-priori at 
the transmitter. The outage secrecy capacity and corresponding optimal power control policy is obtained and then 
the results are generalized to the more practical scenario where only the main channel state information (CSI) is 
available at the transmitter Finally, the impact of the private key queue overflow on secrecy outage probability 
is studied. Overall, our results reveals interesting structural insights on the optimal encoding and power control 
schemes as well as sharp characterizations of the fundamental limits on secure communication of delay sensitive 
traffic over fading channels. 

The rest of this paper is organized as follows. We formally introduce our system model in Section|II] In Section HID 
we obtain the capacity results for the full and main CSI scenarios. The optimal power control policies, for both 
cases, are derived in Section |IV] The effect of key buffer overflow on the outage probability is investigated in 
Section [V] We provide simulations to support our main results in Section |Vl] Finally, Section IVIII offers some 
concluding remarks. To enhance the flow of the paper, the proofs are collected in the Appendices. 

II. System Model 

We study a point-to-point wireless communication link, in which a transmitter is trying to send information to a 
legitimate receiver, under the presence of a passive eavesdropper. We divide time into discrete slots, where blocks 
are formed by N channel uses, and B blocks combine to form a super-block. Let the communication period consist 
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of S super-blocks. We use the notation (s, b) to denote the fe* block in the s* super-block. We adopt a block fading 
channel model, in which the channel is assumed to be constant over a block, and changes randomly from one block 
to the next. Within each block (s, b), the observed signals at the receiver and at the eavesdropper are: 

Y(s, b) = Grais, 6)X(s, b) + W„,(s, b) 

and 

Z(s,6) = Ge(s,6)X(s,6)+We(s,6), 

respectively, where X(.s, b) e is the transmitted signal, Y(s, b) £ is the received signal by the legitimate 
receiver, and Z(s, b) G is the received signal by the eavesdropper. Wm(s, b) and We(s, b) are independent noise 
vectors, whose elements are drawn from standard complex normal distribution. We assume that the channel gains of 
the main channel Gm{s, b) and the eavesdropper channel Ge{s^ b) are i.i.d. complex random variables. The power 
gains of the fading channels are denoted by Hm{s, b) = \Gm{s, 6)p and He{s, b) — \Ge{s, We sometimes use 
the vector notation H(-) — [i?m(-) He{-)] for simplicity, and also use the notation H*''' = {H}^;^^^ j^,^^ to denote 
the set of channel gains H(s', b') observed until block (s, 6). We use similar notation for other signals as well, and 
denote the sample realization sequences with lowercase letters. We assume that the probability density function of 
instantaneous channel gains, denoted as /(h), is well defined, and is known by all parties. We define channel state 
information (CSI) as one's knowledge of the instantaneous channel gains. We define full transmitter CSI as the 
case in which the transmitter has full causal knowledge of the main and eavesdropper channel gains. We define 
main transmitter CSI as the case in which that the transmitter only knows the CSI of the legitimate receiver. In 
both cases, the eavesdropper has complete knowledge of both the main and the eavesdropper channels. Let P(s, b) 
denote the power allocated at block (s, 6). We consider a long term power constraint (or average power constraint) 
such that, 

SB 

limsup — ^^P(s,6)<P,vg (1) 

for some Pavg > 0. 

Let {W^(s, &)}fL^ denote the set of messages to be transmitted with a delay constraint. W{s,b) becomes 
available at the transmitter at the beginning of block (s, b), and needs to be securely communicated to the legitimate 
receiver at the end of that particular block. We consider the problem of constructing (2^^, N) codes to communicate 
message packets W{s, 6) G {1, ■ • ■ , 2^^} of equal size, which consists of: 

1) A stochastic encoder that maps {wis, b), x*"''"^) to x(s, b) based on the available CSI, where x"-''"^ summarizes 
the previously transmitted signal^ and 

2) A decoding function that maps y" '' to w{s, b) at the legitimate receiver 

Note that we consider the current block x(s, b) to be a function of the past blocks x'^ ''^^ as well. This kind of 
generaUty allows us to store shared randomness to be exploited in the future to increase the achievable secrecy rate. 

'An exception is for b = 1, in wliicli case tlie previous signals are summarized by x^"'^'^. 
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Define the error event with parameter 5 at block (s, h) as 

E{sA5) = {W{s,h) ^ W{sM] U {^||X(s,&)f > P{s,h) + 5) 

which occurs either when the decoder makes an error, or when the power expended is greater than P(s, h) + 5. The 
equivocation rate at the eavesdropper is defined as the entropy rate of the message at block (s, h), conditioned on 
the received signal by the eavesdropper during the transmission period, and available eavesdropper CSI, which is 
equal to j^H{W{s,h)\7i^^ ,h.^^). The secrecy outage event at rate R with parameter 5 at block is defined 



aec(s, 6, i?, 6) = aq(s, 6, R, 5) U ah(s, &, R) (2) 

where the equivocation outage 

occurs if the equivocation rate at block (s, h) is less than R — 6, and channel outage 

ah(s,6,i?) = |^/(X(s,6);Y(s,fe)) < R 

occurs if channel at block (s, b) is unsuitable for reliable transmission at rate R. Defining (5sec(0 as the complement 
of the event OsecC')' we now characterize the notion of e-achievable secrecy capacity. 

Definition 1: Rate R is achievable securely with at most e probabiUty of secrecy outage if, for any fixed (5 > 0, 
there exist 5, B and N large enough such that the conditions 

nE{sA5)\6,..{s,b,R,5))<5 (3) 

P(0,ec(s,6,i?,J)) < £ + (5 (4) 

are satisfied for all (s, &), s ^ 1. 

We call such R an e-achievable secrecy rate. Note that the security constraints are not imposed on the first 
super-block. 

Definition 2: The e-achievable secrecy capacity is the supremum of e-achievable secrecy rates R. 

Remark 1: The notion of secrecy outage was previous defined and used in ||6l, IS). However, those works did not 
consider the technique of storing shared randomness for future use, and in that case, secrecy outage depends only 
on the instantaneous channel states. In our case, secrecy outage depends on previous channel states as well. Note 
that we do not impose a secrecy outage constraint on the first superblock (s = 1). We refer to the first superblock 
as an initialization phase used to generate initial common randomness between the legitimate nodes. Note that this 
phase only needs to appear once in the communication lifetime of that link. In other words, when a session (which 
consists of 5* superblocks) between the associated nodes is over, they would have sufficient number of common 
key bits for the subsequent session, and would not need to initiate the initialization step again. 
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III. Capacity Results 

In this section, we investigate this capacity under two different cases; full CSI and main CSI at the transmitter. 
Before giving the capacity results, we define the following quantities. For a given power allocation function P{s, b), 
let Rm{s,b) and Rs{s,b) be as follows, 

b) = log(l + P{s, b)H„,{s, b)) (5) 
Rs{s,b) =[\og{l + P{s,b)H„,{s,b)) -\og{l + P{s,b)H,{s,b))]+ (6) 

where [•]+ = max(-,0). Note that, Rm{-) is the supremum of achievable main channel rates, without the secrecy 
constraint. Also, i?s( ) is the non-negative difference between main channel and eavesdropper channel's supremum 
achievable rates. We show in capacity proofs that the outage capacity achieving power allocation functions lie 
in the space of stationary power allocation functions that are functions of instantaneous transmitter CSI. Hence 
for full CSI, we constrain ourselves to the set V of stationary power allocation policies that are functions of 
h(s, 6) = [hm{s,b) /ie(s, 6)]. For simplicity, we drop the block index (s,6), and use the notation P{h) for the 
stationary power allocation policy. Similarly, with main CSI we consider the power allocation policies that are 
functions of h,n{s,b), and use the notation P{h,n) for the stationary power allocation policy. In both cases, since 
the secrecy rate Rs{s,b), and the main channel rate i?,„(.s, 6) are completely determined by the stationary power 
allocation functions P(-) and channel gains h, we will interchangeably use the notations Rs{s, b) = i?s(h, P) and 
= i?,„(h,P). 

A. Full CSI 

Theorem 1: Let the transmitter have full CSI. Then, for any e, < e < 1, the e-achievable secrecy capacity is 
identical to 

C>= max MM (7) 

P(h)6T" 1 - e 

where the set V' CV consists of power control policies P{h) that satisfies the following conditions. 



1 - e 

E[P(H)] < P,vg (9) 

A detailed proof of achievability and converse part is provided in Appendix lAl Here, we briefly justify the result. 
For a given -P(h), i?s(h, P) the supremum of the secret key generation rates within a block that experiences channel 
gains h |31|. This implies that the expected achievable secrecy rate l?) is E[i?s(H, P)] without the outage constraint. 
With the outage constraint, the fluctuations of Rs(H.,P) due to fading are unacceptable, since i?s(H, P) can go 
below the desired rate when the channel conditions are unfavorable (e.g., when iJ,„ < H^, i?s(H, P) = 0). Hence, 
we utilize secret key buffers to smoothen out these fluctuations to provide secrecy rate of E[Rs{ii, P)] at each 
block. The generated secrecy is stored in secret key buffers of both the transmitter and receiver, and is utilized to 
secure data of same size using Vernam's one-time pad technique. With the allowable amount of secrecy outages, this 
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rate goes up to E[i?s(H, P)]/ (1 — e). The channel outage constraint ([8]l on the other hand is a necessary condition 
to satisfy the secrecy outage constraint in (|4]i due to (|2]i. 

Example 1: Consider a four state system, where H,n and takes values from the set {1,10} and the joint 
probabiUties are as given in Table U Let the average power constraint be P^vg = 0.5, and there is no power control, 
i.e., P(h) = Pavg Vh. The achievable instantaneous secrecy rate at each state is given in Table HH According to the 
pessimistic result in [6,8], any non-zero rate cannot be achieved with a secrecy outage probability e < 0.6 in this 
case. However, according to Theorem 1, rate R = can be achieved with e secrecy outage probabilitj]^ since 
E[i?s(H, Pavg)] = 0.8. A sample path is provided for both schemes in Figure [T] and it is shown how our scheme 
avoids secrecy outage in the second block. 



TABLE I 
P(h) 



TABLE II 
/J^Ii.Pavg) 



i h,n \ he 


1 


10 


4- hm \ he ^ 


1 


10 


1 


0.1 


0.1 


1 








10 


0.4 


0.4 


10 


2 






Rates 
Strategy 1 



block 1, h = [10 1] 

Rrri — 2.58, Rg — 2 



wiretap 
channel 



block 2, h = [10 10] 
i?„ = 2.58, R, = 



Outage 



n 1 bit 


-ff, = -' 


1 data bit ^ 







wiretap 
channel 



Strategy 2 



random bit 
generator 



M key "i"'"? ^bSY 
a queue channel / 



M key 
1=1 queui 



No Outage 



random bit 
generator 



key 
queue 



wiretap 
channel 



key 
queue 



I bit 

:ncryptcd 



Fig. 1. A sample path. With strategy 2, secrecy outage can be avoided for block t = 2 via the use of key bits. 



B. Main CSI 

Theorem 2: Let the transmitter have main CSI. Then, for any e, < e < 1, the e-achievable secrecy capacity is 
identical to 

max (10) 

P{h„^)eV" 1 - e 

^Although Theorem 1 is stated for the case where random vector H is continuous, the result similarly applies to discrete H as well. 
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where the set V" C V consists of power control pohcies P{h„i) that satisfies the following conditions. 

i?m(H,P)< <e (11) 



1 - e 

E[P(i/„0] < Pavg (12) 

Although the problems (|7]i-(|9]l and (fT0b-(fT2]) are of the same form, due to the absence of eavesdropper CSI, the 
maximization in this case is over power allocation functions V" that depend on the main channel state only. Hence, 
C%i < Cp. A detailed proof of achievability and converse is provided in Appendix iBl As in the full CSI case, our 
achievable scheme uses similar key buffers and Vernam's one time pad technique to secure the message. The main 
difference is the generation of secret key bits. Due to the lack of knowledge of He{s, h) at the transmitter, secret key 
bits cannot be generated within a block. Instead, using the statistical knowledge of He{s, b), we generate keys over 
a super-block. Roughly, over a superblock the receiver can reliably obtain N BElRmCH., P)] bits of information, 
while the eavesdropper can obtain A^_BE[i?m(H, P) — i?s(H, P)] bits of information. From privacy amplification 
arguments ||9l, N BK[Rs{ll, P)] bits of secret key can be extracted by using a universal hash function. 

Now, we show that power allocation policy has minimal impact on the performance in the high power regime. 

Theorem 3: For any e > 0, the e-achievable secrecy capacities with full CSI and main CSI converge to the same 
value 

lim Cp = hm Cm = (13) 

Pavg^OO Pavg-S-OO (1—6) 

Proof: For h = [hm he] such that ft,,„ > he, we can see from ^ that limp(h)^oo ^s(h, P) = log (^^^, and 
for h,n < he, i?s(h, P) = 0. Furthermore, for /i,„ > 0, we can see from (|5]l that limp(h)^oo Pm(h, P) = oo. Let 
P(h) = Pavg (no power control), which does not require any CSI. Then, we get 

lim E[P,(H, P)] = EH^>He log {H„jHe) < oo 

Combining the last 2 equations, we get 

lim P f P„ (H, P) < ^iMil^') = p(ff,„ = 0) 

and P{H„i = 0) = 0, since probabihty density function of H is well defined. Hence, channel outage constraints 
(O and (fTTl i are not active in the high power regime. Therefore, P(h) G V', and P(h) G V". From (It]!-© and 
(Unil-dnii, we conclude that Cf = Cm = EH„,>He log {H,n/He) /(I - e). ■ 
Our simulation results also illustrate that the power allocation policy has minimal impact on the importance in the 
high power regime. On the other hand, when the average power is limited, the optimality of the power allocation 
function is of critical importance, which is the focus of the following section. 

IV. Optimal Power Allocation Strategy 

A. Full CSI 

The optimal power control strategy, P*(h) is the stationary strategy that solves the optimization problem (|7]i-(|9|l. 
In this section, we will show that P*(h) is a time-sharing between the channel inversion power policy, and the 
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secure waterfilling policy. We first introduce the channel inversion power policy, Pi„v(h, R), which is the minimum 
required power to maintain main channel rate of R. For h = [hm he\, 

Pi„v(h,i?) = ^^J— i (14) 



Next we introduce Pwf (h, A), 

i^wf(h,A) = i 



1 4/1 1\ /I 1 



(15) 



We call it the 'secure waterfilling' power policy because it maximizes the ergodic secrecy rate without any outage 
constraint, and resembles the 'waterfilling' power control policy. Here, the parameter A determines the power 
expended on average. Now, let us define a time-sharing region 

g{X,k) = {h : [i?,(h,P,„v) - i?.(h,P„f)]+ - A[Pi„,(h,6) - Pwf(h, A)]+ > fc} (16) 

which is a function of parameters A and k. 
Theorem 4: P*(h) is the unique solution to 

P*(h) =Pwf(h,A*) + l(h e g{\*X)) (P,nv(h,C|,) - Pwf(h, A*))+ (17) 

subject to: fc* < 0, A* > 

=E[i?,(H,P*)]/(l-e) (18) 
P(H e a(A*,fc*)) = 1 (19) 

E[P*(H)] = Pavg (20) 

where E[Ps(H, P*)] is the expected secrecy rate under the power allocation policy P*(h). 
Proof: Define a sub-problem 

E[P,(H,P^)] =niaxE[P^(H,P)] (21) 

subject to: P(h) > 0, Vh 

E[P(H)] < P,vg, (22) 
P(i?,„(H,P) < P) < e (23) 

Let P^(h) be the power allocation function that solves this sub-problem. Note that for R = E[Ps(H, P^)]/(l — e), 
this problem is identical to ([Til-®, hence giving us P*(h). We will prove the existence and uniqueness of such R. 

Lemma 1: There exists a unique P,nax > such that the sub-problem (l2ni-(l23Tl has a solution for all R < Pmax, 
which is found by solving 

Pavg= / P,„v(h,P,„ax)/(h)dh (24) 

for h = [hm hg], where the constant c is chosen such that F{Hm < c) = e. 



December 14, 2011 



DRAFT 



8 



Proof is provided in Appendix IC-AI 
Lemma 2: For any R < Rmax, 

P^(h) =Pwf(h, A) + 1 (h G g{X, k)) (Pi„v(h, R) - Pwf(h, A)) + 

where k £ (— oo,0] and A G (0, +oo) are parameters that satisfy (|22] | and (|23]) with equality. 

Proof is provided in Appendix iP] It is left to show there exists a unique R that satisfies R = E[Rs{fl, P^)]/(l — e). 

Lemma 3: E[i?s(H, P^)] is a continuous non-increasing function of R. 
Proof is provided in Appendix IC-B I 

Lemma 4: There exists a unique R,0<R< Pmax, which satisfies R = E[P^(H, P^)]/(l - e). 
Proof is provided in Appendix IC-C I This concludes the proof of the theorem. ■ 
Due to (Vh . the optimal power allocation function is a time-sharing between the channel allocation power allocation 
function and secure waterfilling; a balance between avoiding channel outages, hence secrecy outages, and maxi- 
mizing the expected secrecy rate. The time sharing region Q{X,k) determines the instants h, for which avoiding 
channel outages are guaranteed through the choice of P{h) = max(Pinv(h, R), Pwf(h, A)). ( fT9] ) ensures that channel 
outage probability is at most e, and ( l20l ) ensures that average power constraint is met with equality. (fTSI l, on the 
other hand, is an immediate consequence of (|7]i. 

Note that, an extreme case is P*(h) = P„f(h, A*) Vh, which occurs when Pinv(h, P) < Pwf(h, A*) for any 
h e g{X* , k*), which translates into the fact that the secure waterfilling solution itself satisfies the channel outage 
probability in (O. However, that the other extreme (P*(h) = Pinv(h, P*) Vh) cannot occur for any non-zero e 
due to ( [TtI i. The parameter Cp can be found graphically as shown in Figure m by plotting E[P,,(H, P^)] and and 
(1 — e)P as a function of P. The abcissa of the unique intersection point is P = Cp. 

Finding C^^ on Graph 



E[RJ H,P°f)] 



-E[R^(H,P")l 

(1-e)R 



Fig. 2. Finding Cp with grapliical approacli 

Example 2: Consider the same system model in Example [T] We have found that for P = bits/channel use 
is achievable with e probability of secrecy outage with no power control, i.e., P(h) = 0.5 Vh. Let e = 0.2, we 
will see if we can do better than P = 1 with power control. Solving the problem (fT7b-(l20l). we can see thai] the 

'Altliougli Tlieorem |4] assumes H is a continuous random vector, tlie results similarly hold for the discrete case as well. 
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time-sharing, and power expended in each state are as given in Tables Hill and |IV| For h = he] = [10 1], i.e., 
the legitimate channel has a better gain, secure waterfiUing is used and when h = [10 10], secret key bits cannot 
be generated, but channel inversion is used to guarantee a main channel rate of R, which is secured by the excess 
keys generated during the state h ~ [10 1]. As a result, we can see that a rate of Cp^ ~ 1.26 bits/ per channel use 
is achievable, which corresponds to 26% increase with respect to no power control. As mentioned in Theorem [3] 
this gain diminishes at the high power regime, i.e., when Pavg oo. 



TABLE III TABLE IV 

Time SHARING REGIONS P*(h) 



4- hm \ he 


1 


10 


ihm \ he -i> 


1 


10 


1 


wf 


wf 


1 








10 


wf 


inv 


10 


1.11 


0.14 



B. Main CSI 

Here, we find the optimal power control strategy P*{h,n), which solves the optimization problem (fT0b-(fT2]). Let 
us define Pw{h,n, A) as the maximum of 0, and the solution of the following equation 

dE[R,{H,P)] _ h,nF{he < K^) / h. 



dP{h„,) l + h,nP{h,n) Jn \l + heP{h,n), 

Pw{hm, A) will replace Pwf(h, A) in the full CSI case. 
Theorem 5: P*{hm) is the unique solution to 

P*{h^) ^P^hm., A*) + lihm > C) (Pinv(/i™, Q/) " -P»(/irn, A*))+ (26) 

subject to; A* > 

Cij^E[Rs{U,P*)]/{l-e) (27) 
¥{H„^ > c) = 1 - e (28) 

nP*{Hrn)] = Pavg (29) 

where E[Ps(H, P*)] is the expected secrecy rate under the power allocation policy P*{h„i). 

Proof: The proof follows the approach in Full CSI case, hence we omit the details for brevity. Define the 
sub-problem 

E\R, (H, P^)] = max E [P, (H, P)] (30) 
subject to: P{h,n) > 0, V/i,„ 

nP{Hrr.)] < Pavg, (31) 

P(P„(H,P) <P) <e (32) 
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Let P^'{h„i) be the power allocation function that solves this sub-problem. Lemmas [T] and |4] also hold in this case. 
The only difference is the following lemma, which replaces Lemma |2] in Full CSI. 

Lemma 5: For any R < i?max, 

where c is a constant that satisfies ¥{H„i > c) = 1 — e, and A e (0, +oo) is a constant that satisfies dSTT i with 
equality. 

The proof is similar to the proof of Lemma |2] and is provided in Appendix [E] ■ 
The graphical solution in Figure |2] to find Cp also generalizes to the main CSI case. 

V. Sizing the Key Buffer 

The proofs of the capacity results of Section assume availability of infinite size secret key buffers at the 
transmitter and receiver, which mitigate the effect of fluctuations in the achievable secret key bit rate due to fading. 
Finite-sized buffers, on the other hand will lead to a higher secrecy outage probability due to wasted key bits by 
the key buffer overflows. We revisit the full CSI problem, and we consider this problem at 'packet' level, where 
we assume a packet is of fixed size of N bits. We will prove the following result. 

Theorem 6: Let e' > e. Let A/cj,(e') be the buffer size (in terms of packets) sufficient to achieve rate Cp with 
at most e' probability of secrecy outage. Then, 

Mc (e') - Cp 

lim ^:-Fy_J_ F ^ ^ ^ ^33^ 

e'\e Var[fl,(H,P'^F)] + (C|.)^e(l-£) / Var[fl, (H.P^F )] + (C^)^£(l-e) \ 

Before providing the proof, we first interpret this result. If buffer size is infinite, we can achieve rate Cp with e 
probability of secrecy outage. With finite buffer, we can achieve the same rate with e' probability of secrecy outage. 
Considering this difference to be the price that we have to pay due to the finiteness of the buffer, we can see that 
the buffer size required scales with O (^-pzr^ log 737)' as e' — e ^ 0. 

Proof: Achievability follows from simple modifications to the capacity achieving scheme described in Ap- 
pendix |A] We will first study the key queue dynamics, then using the heavy traffic Umits, we provide an upper 
bound to the key loss ratio due to buffer overflows. Then, we relate key loss ratio to the secrecy outage probability, 
and conclude the proof. 

For the key queue dynamics, we use a single index t to denote the time index instead of the double index (s, b), 
where t = sB + b. We consider transmission at outage secrecy rate of R, and use power allocation function P^(h), 
which solves the problem (I2n i-(|23]|. Let us define {QM{t)}f^i as the key queue process with buffer size M, and 
let Qai{1) = 0. Then, during each block t, 

1) The transmitter and receiver agree on secret key bits of size Rs{t) using privacy amplification, and store the 
key on their secret key buffers. 

2) The transmitter pulls key bits of size R from its secret key buffer to secure the message stream of size R 
using one time pad, and transmits over the channel. 
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as explained in Appendix lAl The last phase is skipped if outage (Oenc(O) declared, which is triggered by one 
of the following events 

• Channel Outage (Och(O)- The channel cannot support reliable transmission at rate R, i.e. Rm{t) < R- 

m Key Outage {Oi,ey{t)): There are not enough key bits in the key queue to secure the message at rate R. This 
event occurs when QM{t) + Rs{t) — i? < 0. 

• Artificial outage (C'a(t)): Outage is artificially declared, even though reliable transmission at rate R is possible. 

Due to the definition of P^(h), V{Och{t)) < e Vt, and the set {Ochit)} of events indexed by t are i.i.d. We choose 
{Oa(0} such that 0„(t) = Och(t) U 0^{t) is i.i.d. as well, and 

P(a(t)) = e, Vi 
The dynamics of the key queue can therefore be modeled by 

QM{t + 1) = niin(A/, Quit) + Rs{t) ~ l{0,no{t))R) (34) 

Note that QM{t) > \ft, due to the definition of OkeylO- 

Let L^{M) be the time average loss ratio over the first T blocks, for buffer size M, which is defined as the 
ratio of the amount of loss of key bits due to overflows, and the total amount of input key bits 

^T.^^^ ^ ELi {QM{t) + Rs{t) - l(0enc(t))fl - M)^ 

Then, we can see that VT > 0, 

T T 
(1 - L^(A/)) Rs{t) = Qm{T) + J2 ^l((5enc(<)) (36) 
t=l t=l 

follows from (l34]l, and the fact that = 0. 

Lemma 6: QM{t) converges in distribution to an almost surely finite random variable. 
The proof is provided in Appendix IF-AI This implies that limt_>oo IP(Cenc(^)) exists. Now, we provide our asymptotic 
result for the key loss ratio. We define the drift and variance of this process as 

fiR^E[Rs{H,P''')-Rl{d,{m 

= E[i?,(H,P^)]-i?(l-e) (37) 

and 

4 = Yar[Rs{H, P^) - 

respectively, where ( |37] i follows from the definition of Oji{t). 

Lemma 7: For any M > 0, the key loss ratio satisfies the following asymptotic relationship 



lim lim L' Mj^ ^ V " < e"^" (38) 



The proof is provided in Appendix IF-BI 
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Lemma 8: If linit^oo ]P(Cenc(0) = 'hen e' secrecy outage probability (HI is satisfied. 

Proof: Find S such that P(Oenc(i)) = e' + (5 for any t > B. In 2-index time notation (s, &) with t = sB + h, 
it corresponds to P(Oenc(s, 6, i?)) = e' + 5, V(s, 6) : s 7^ 1. Then. 

P(0sec(s, 6, i?, < P(0sec(s, 6, i?, <5)|a„c(s, 6, R)) + P(anc(s, 6, i?)) (39) 
<P(Oe„c(s,fo,i?)) (40) 

<e' + (5 (41) 

Here, ( [39l ) follows from the union bound, and second term follows from the equivocation analysis (l54l i and ( |55] | in 
Appendix A, which shows that there exists some packet size N large enough such that P(C'sec(s, R, (5)|(5enc(s, b, R)) 
0. Equation dTTl l implies that e' secrecy outage probability (HJi is satisfied. ■ 

Let limt_,oo P(Oenc(^)) e'. Since P(Ox(i)) = e and Oe„c(i) = 0„{t) U OkeylO' we have limj^oo PCOkeylO) > 0- 
This implies that limT-j-oo ^Qm{T) — (since otherwise, key outage probabihty would be zero), which, due to 
( [36] l impUes 

(1 - lim L'^{M))E[Rs{U,P^)] = (1 - lim P{0,n,{t)))R 

= (1 - e')R (42) 

Here, due to the choice of power allocation function P^(h), we have E[Rs{U,P")] = limr^oo ^J^J^i Rs{t). 
Plugging the result of Lemma [7] into (l42l) . we obtain the required key buffer size to achieve e' probability of secrecy 
outage 

,i„ ^ Mi(fV« ^ , 1 ,43) 

We know from (|7]i that e and e'-achievable secrecy capacities satisfy the conditions Cp (1— e') = E[i?s(H, P^)] \ f^^Q,' 
and Cpil -e) = E[i?s(H, P^)] |ij=c], = IE[i?,.(H, P*)], respectively. By Lemma[3] we know that E[i?s(H,P«)] 
is a continuous function of R, hence for any given e' > e, there exists an R such that Cp < R < Cp, and 
¥,[Rs{h, P^')] = (1 — ^^-)R. Furthermore, as e' — > e, Cp Cp. Let us define a monotonically decreasing 
sequence (e'(l), e'(2), • ■ • ), such that limi_^oo e'(«) = £■ For any i G N, find R{i) such that Cp < < C^**', 
and E[i?s(h,P^(^))] = (1 - therefore (e - e')/{2R{i)). From gill, we get 



2— >-CX3 



■log 



Since as i — !■ cxd, R{i) — > C|., e'(i) — e and o'^(j) -> cr^« , where 

< Var[P,(H,P^^)] -C|,(l-e)e 
The last inequality induces the upper bound (|33] |. which concludes the proof. 
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VI. Numerical Results 

In this section, we conduct simulations to illustrate our main results with two examples. In the first example, we 
analyze the relationship between e-achievable secrecy capacity and average power. We assume that both the main 
channel and eavesdropper channel are characterized by Rayleigh fading, where the main channel and eavesdropper 
channel power gains follow exponential distribution with means 2 and 1, respectively. Since Rayleigh channel is 
non-invertible, maintaining a non-zero secrecy rate with zero secrecy outage probabiUty is impossible. In Figure [3] 
we plot the e-achievable secrecy capacity as a function of the average power, for e ~ 0.02 outage probabiUty, for 
both full CSI and main CSI cases. It can be clearly observed from the figure that the gap between capacities under 
full CSI and main CSI vanishes as average power increases, which support the result of Theorem [3] 



Outage Capacity vs Power 




10 20 30 40 50 60 

Average Power, P 



Fig. 3. The e-achievable secrecy capacities as a function of average power, P^vg 

In the second example, we study the relationship between the buffer size, key loss ratio and the outage probability. 
We assume that both the main and eavesdropper channel gains follow a chi-square distribution of degree 2, but 
with means 2 and 1, respectively. We focus on the full CSI case, and consider the scheme described in Section IV] 
We consider transmission at secrecy rate of R with the use of the power allocation policy P^(h) that solves the 
problem (|2TI) -(|23]). For e = 0.02, and the average power Pavg = 1, we plot the key loss ratio ( |35] ), as a function 
of buffer size M in FigureH] for R ~ Cp, R = 1.01C|. and R ~ l.Q2Cp, where Cp is the e-achievable secrecy 
capacity. It is shown in Lemma [T] of Section [V] that expect the key loss ratio {M) decreases as R increases, 
which is observed in Figure |4] Finally, we study the relationship between the secrecy outage probability and the 
buffer size for a given rate. In Figure |5] we plot the secrecy outage probabilities, denoted as e', as a function of 
buffer size M for the same encoder parameters. On the same graph, we also plot our asymptotic result given in 
Theorem|6l which provides an upper bound on the required buffer size to achieve e' outage probability for rate Cp, 
with the assumption that ( |33] | is an equality for any e'. We can see that, this theoretical result serves as an upper 
bound on the required buffer size when e' — e, which is the additional secrecy outages due to key buffer overflows. 
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is very small. Another important observation from Figures |4] and |5] is that, for a fixed buffer size, although the key 
loss ratio decreases as R increases, secrecy outage probability increases. This is due to the fact that key bits are 
pulled from the key queue at a faster rate, hence the decrease in the key loss ratio does not compensate for the 
increase of the rate that key bits are pulled from the key queue, therefore the required buffer size to achieve same 
e' is higher for larger values of R. 

Buffer Size vs Outage Probability 
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Fig. 4. Relation.ship between buffer size AI, and key loss ratio 



Fig. 5. Relationship between buffer size M, and outage 
probability e' 



VII. Conclusions 

This paper obtained sharp characterizations of the secrecy outage capacity of block flat fading channels under the 
assumption full and main CSI at the transmitter In the two cases, our achievability scheme relies on opportunistically 
exchanging private keys between the legitimate nodes and using them later to secure the delay sensitive information. 
We further derive the optimal power control policy in each scenario revealing an interesting structure based by 
judicious time sharing between time sharing and the optimal strategy for the ergodic. Finally, we investigate the 
effect of key buffer overflow on the secrecy outage probability when the key buffer size is finite. 

Appendix A 
Proof of Theorem[T] 

First, we prove the achievability. Consider a fixed power allocation function P{h) G V. Let us fix i? < 
E[i?s(H, P)]/{1 — e). We show that for any (5 > 0, there exist some B and N large enough such that the constraints 
in ^ and (HJi are satisfied, which implies that any R < E[i?s(H, P)]/(l — e) is an e-achievable secrecy rate. The 
outage capacity is then found by maximizing E[i?s(H, P)]/(l — e) over the set V' of power allocation functions. 

Our scheme utilizes secret key buffers at both the transmitter and legitimate receiver. Then, 
i) At the end of every block (s, b), using privacy amplification, legitimate nodes (transmitter and receiver) generate 
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N{Rs{s, b) — S) bits of secret key from the transmitted signal in that particular block, and store it in their secret 
key buffers. We denote the generated secret key at the transmitter as V{s, b), and at the receiver as V{s, b). 
ii) At every block (s, 6), s 7^ 1, the transmitter pulls NR bits from its secret key buffer to secure the outage 
constrained message of size H{W{s,b)) = NR, using Vernam's one time pad. The receiver uses the same key 
to correctly decode the message. We denote the pulled key at the transmitter as K{s, b), and at the receiver as 
K{s, b). For simplicity in analysis, we assume that keys generated at s — I'th superblock are used only in the s'th 
superblock. This stage is skipped in the first super-block, and when 'encoder' outage Oenc{s,b, R) occurs, which 
is the union of the following events: 

• Channel outage (C'ch(s, b, R)): Channel is not suitable for reliable transmission at rate R, i.e., Rm{s, b) < R. 

m Key outage (C'key(s, b, R)): There are not enough key bits in the key queue to secure W{s, b), i.e.. 



(j2 H{v{s 1, b')) ^(^(■^' ^')) ) < 

\6' = 1 b' = l / 



• Artificial outage (03(5, 6, i?)): The transmitter declares 'outage', even though reliable secure transmission of 
W{s, b) is possible. This is introduced to bound the probability of key outages, and is explained in the outage 
analysis. 

Encoding: 

Our random coding arguments rely on an ensemble of codebooks generated according to a zero mean Gaussian 
distribution with variance P(s, b) Q 

1) When Oi^nc{s, b, R) does not occur, the message is secured with the secret key bits pulled from the key queue, 
using one time pacjf] 

Wsecis, b) = W{s, b) © Kis, b) (44) 

Clearly, W,ec{s, b) e Wsec = {1, ■ ' ■ , 2^-^}. Furthermore, let W^i{s, b) ^ {!,■■■ , 2^^^'^^''''^-^-^^}. To transmit 
the one time padded message Wseds, 6), the encoder randomly and uniformly chooses Wxi{s, b) among Wxi{s, b), 
and transmits to codeword x(s, b) indexed by {wsec{s, b),Wxi{s, b)) over the channel. 

2) When Oenc(s, b, R) occurs, W{s, b) is not transmitted. Let Wx2 = {1, ■ • • , 2^(^"('''^)-'''}. The encoder randomly 
and uniformly chooses Wa:2(s, 6) among Wx2, and transmits to codeword x(s,6) indexed by Wx2{s,b) over the 
channel. 

The reason for transmitting Wxiis, b) and 'Wx2{s, b) is to confuse the eavesdropper to the fullest extent in the privacy 

amplification process. 

Decoding: 

1) When Oeac{s,b,R) does not occur, the receiver finds the jointly typical {'Wsec{s,b),Wxi{s,b),Y{s,b)) pair, 
where y(s, b) denotes the received signal at block (s, b). Then, using one-time pad, the receiver obtains w{s, b) = 

''Note that, it is also possible to use a finite number of codebooks by partitioning the set {h} of channel gains, and using a different Gaussian 
codebook for every partition (4). 

^We assume that both the message and the key are converted to binary form in this process. 
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Wsec{s, b) © k{s, b). 

2) When Oencls, b, R) occurs, the receiver finds the jointly typical {wx2{s, b),y{s, b)). 



Define the error events 



Ei{s,b) 



{{■Wsec{s,b),Wxl{s,b)) / {Wsec{s,b),Wxl{s,b))} 



£2(3, b) = {Wa;2(s,&) 7^ Wx2{s,b)} 

E3{s,b,S)^\h\X{s,b)\\'>P{s,b) + S 




Independent of whether the event Oencis,b, R) occurs or not, the encoding rate is equal to R„i{s,b) — S, which 
is below the supremum of achievable main channel rates. Furthermore, each element of X(s, b) is independently 
drawn from Gaussian distribution of mean and variance P{s, b). Therefore, random coding arguments guarantee 



us that VS > 0, 3Ni > such that VA^ > iVi, ¥{Ei{s, b)) < ^, ^{E2{s, b)) < ^ and P(-B3(s, b)) < f . 



Privacy Amplification: At the end of every block (s, b), the transmitter and receiver generate secret key bits, by 
applying a universal hash function on the exchanged signals in that particular block. First, we provide the definition 
of a universal hash function. 

Definition 3: ( ||9l) A class G of functions A ^ B is universal, if for any xi ^ X2 in A, the probability that 
g{xi) = g{x2) is at most when g is chosen at random from G according to a uniform distribution. 

Lemma 9: For any B > 0, there exists N2{B) > such that, VA^ > N2{B), and for any block (s, 6), 

• When Oenc{s,b, R) does not occur, the transmitter and receiver can generate secret key bits V{s,b) = 



Gi[Wsecis,b) Wxi{s,b)]) and V{s,b) = G{[Wsecis,b) Wxi{s,b)]) respectively, such that Vis,b) = f (s,6) 
if the error event Ei{s,b) does not occur, and 



• Similarly, when Oenc{s,b, R) occurs, the transmitter and receiver can generate secret key bits V{s,b) = 
G{[Wx2{s,b)]) and V{s,b) = G{[Wx2{s,b)]) respectively, such that V{s,b) = V{s,b) if the error event 
E2{s,b) does not occur, and i45[ . ( |46] | are satisfied. 

Proof: The proof follows follows the approach of which applies privacy amplification to Gaussian 

channels. First, we introduce the information theoretic quantities required for the proof. For random variables 
A, B, define 

• Renyi entropy of A as logE[PA(a)] 

• Min-entropy as A as Hoo{A) = miiia log ■ 

m Conditional min-entropy of A given B as Hoo{A\B) = infb Hao{A\B = b). 
> (5-smooth min-entropy of A as H^{A) = max^/.||p^_p^, iJoo(^')- 

Without loss of generality, we drop the block index (s, b) and R, and focus on the first block (1, 1), and assume 
the event Oenc does not occur. Let Wx = [Wsec Wxi], with sample realization sequences denoted by w^- Let 



H{V{s,b))=N{Rs{s,b)-S) 



(45) 




G) < S/B 



(46) 
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V = G{Wx), where G denotes a random universal hash function that maps Wx to to an r-bit binary message 

V e {0, l}*". Then, it is clear that if error event Ei does not occur, V = V since Wx = Wx, for any choice of 
G. To show that the security constraints (I45b-(l46b are satisfied, we cite the privacy amplification theorem, which 
is originally defined for discrete channels. For this purpose, we define a quantization function cj), with sensitivity 
parameter A = sup^. |z — 0(z)|. Let = 0(Z) denote the quantized version of Z. where denotes reaUzation 
sequences. Then, by Theorem 3 of ||9l there exists a universal function G such that^ 

HiGiWx)\Z^ = z^, G) > r — 

Now, we relate this expression to the Shannon entropy of the message, conditioned on eavesdropper's actual received 
signal. Using the facts HooiWx) < RiWx) and H^{Wx\Z^,G) < HooiWx\Z^ = z^,G), it is easy to show 
that 

Or-H^iWxlZ^) 

H{G{Wx)\Z'^,G) > r - - 



In 2 

Then, due to the asymptotic relationship between continuous random variables and their quantized versions ifTsl . 
there exists a quantization function cj) such that A is small enough, and 

H{G{Wx)\G, Z) > H{G{Wx)\G, Z^) - 

> r (47) 

ln2 2B ^ ' 

are satisfied. To relate min-entropy to Shannon entropy, we use the result of Theorem 1 of fTTl; \/5' > 0, 3 a block 

length TV' such that VTV > N', 

Iff(X^IZ^) < 1<(X^|Z^) + 6/B (48) 

Now, we proceed as follows, 

H^{Wx\Z^) - lim Hi{W\Z^) 

> H{Wx) - I(Wx;Z'^) - N5/B (49) 

> H{Wx) - Ii^;Z) - NS/B (50) 
= NR,-Nd/B (51) 

where ( |49] l follows from (l48T l. and the appropriate choice of N'. ( fSOb follows from the fact that Wx — X — > 
Z ^ forms a Markov chain.(|5T]i follows from the fact that H{Wx) = TV(i?m - S), and similarly /(X; Z) < 
N{Rjn — i?s — 5), which is the eavesdropper's maximum achievable rate. For the choice of H{V) = r = N{Rg — 6), 

*We omit h'^^ in the following parts of the proof of Lemma |9] for notational simplicity. 
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from (|47]i, (|5T]l, and the fact that V = G{Wx), we get 



liV; G, Z) = HiGiWx)) - H{GiWx)\Z, G) 

2-JV(S-l)/B g 



< 



In 2 2B 



4 



since there exists some N" such that forall N > N", (l52l i Hence, for N > N2 = ma,x{N' , N"), the constraints 
(l45T l. (l46T l are satisfied. The proof for the case where Oenc occurs is very similar, and is omitted. ■ 
Equivocation Analysis: Secrecy outage probability can be bounded above as 

P(Osec(s, b, R, S)) = P(Oeq(s, b, R, S) U Och(s, 6, R)) 

<P(C'eq(s,&,i?,(5)Ue>enc(s,&, i?)) 

< P(Oeq(s, &, i?, <5)|aenc(s, 6, R)) + P(Oenc(s, &, i?)) (53) 

where the first equality follows from the definition of secrecy outage (|2]), and ( [53] ) follows from the union bound. 
Now, we upper bound the first term. For the choice N,B such that N = niax{Ni{B) , N2{B)), the equivocation 
at every block (s, b) in case of no encoder outage can be bounded as 

H{W{s, 6)|Z^^, h^^, G, (5e„c(s, b, R)) 

^=^i7(W^(s,6)|Z(s-l,:),h^^,G,aenc) 
-I{W{s, b); Z{s, b)\Z{s - 1, :), G, (5e„c) 

> H{W{s,b)) ~ l{W{s,b);Z{s,b),Wsec{s,b)\ 
Z(s-l,:),h^^,G,a„c)) 

> NR - I{W{S, b); Wsecis, b)\Z{s - 1, :), h^^, G, Oenc)) 

(rf) 

>NR- H{K{S, b)\Z{s - 1, :), h^^, G, Oenc)) 

(-) A 

>NR-Y, H{V{s - 1, 6)|Z(s - 1, :), h^^, G, Oenc)) 

b=l 

> N{R - S) (54) 

where we use the notation Z(s, :) ~ {Z(.s, and omit the index {s,b,R) from Oenc{s,b, R). Notice that 

W{s, b) = Wsec{s, b) © K{s, b), and due to our encoder structure, Wsec{s, b) is transmitted only in (s, &)'th block, 
and similarly, K{s, b) is generated in s — I'th superblock. Then, due to the memoryless property of the channel, 
W{s,b) ^ (Z(s,&),Z(s - 1,:)) Z^^, hence (a) follows. The first term of (&) follows since Wsec{s,b) is 
independent of Z(s — 1,:), and the second term of (6) follows since W{s,b) Wsec{s,b) — > Z(s, 6) forms a 
Markov chain, (c) follows due to H{W{s, b)) = NR. (d) follows since there is no encoder outage, hence key outage, 
and (e) follows since K{s, b) is pulled from the key buffers, which contain the pool of key bits {V{s — 1, b)}^^^ 
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generated during superblock s — 1, and ( |54l i follows from ( |46] l. Then, 

P(Oeq(s, 6, i?, <5)|ae„c(s, b, R)) = P(li/(W^(s, &) | Z^^ , h^^ , G) <R~5) 

= (55) 
Now, we bound the encoder outage probability. By the union bound, 

P(anc(s, b, R)) < P(Och(s, b, R) U a(s, b, R)) + P(Okey(s, b, R)) 
Since P(h) e 7", due to the definition in (O, V(s, &) 

P(ah(s,6,i?)) = P(i?™(s,&) < R) 

<i)p(^«.,.,H,P,<s^iaa)<. 

where in (/), we interchangeably use Rm{s,b) = i?m(h, P) due to stationarity of P{h). Note that, the events 
Och{s,b, R) indexed by {s,b) are i.i.d. Here, we introduce i.i.d. artificial outages 0,i{s,b,R) such that 

P(ah(s, b, R) U b, R)) = e, V(s, b) 

This would help us bound the probability of key outage. For (s, b), s ^ 1 

P(Okey(5, b, R)) ^(^(^ - 1' »)) - E ^(^(*' *)) < ) 

\i=l i=l ) 

, B b 

= P f ^ N{Rs{s -l,i)-S)-J2 NRl{d,h{s, i, R) n 0,{s, i, R)) < 

<P^^[i?s(s-l,^)-(5-i?l(Och(s,^,-R)naa(s,^,i^))] < j (56) 

Note that, the expression in ( |56] l represents a random walk with expected drift fi = K[Rs (H, P)] — (5 — i?(l — e). For 
i? < ^ > 0, hence by the law of large numbers, 3Bi > such that \/B > Bi, P(C'key(s, 6, R)) < S, 

s ^ 1. Therefore, due to union bound and (|55]l, for the choice B = Bi, N = niax(iVi(Bi), iV2(Si)), 

P(Osec(s, b,R,S))<e + S, which satisfies ©. 
Error Analysis: For A^, B such that B = Bi, N = ma.x{Ni{Bi), N2{Bi)), V(s, 6), s 7^ 1, 

P(P(s, &, ,5)|Oenc(s, b, R)) < ¥{W{s, b) + W{s, b)) + P (^^l|X(s, b)f > P{s, b) + S 

= P(W,ec(s, b) © Kis, b) ^ W,ec{s, b) © k{s, b)) + P &)f > b) + 5 

< P(W^.ec(s, b) ^ W,,,{s, b)) + nK{s, b) ^ K{s, b)) ||X(s, 6) f > P{s, b) + 6 

where the first term can be bounded as F{Wsecis,b) ^ Wsecis,b)) < due to definition of Ei{s,b), and the 
choice of N. Similarly, the third term can be bounded as F{Wsec{s,b) ^ tVsec(s,^)) < <5/3 due to definition of 
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E^is, b), and the choice of N. The second term can be bounded as 

(a) ^ 

F{K{s, b) ^ k{s, &)) < 1 - n ^^(^(s -'^,i) = V{s-l,i)) 



1=1 

B 



<Y,nv{s~i.i)^v{s-i,i)) 

i=l 
B 



+P(£;2(s-l,l))P(Oenc(s-l,*,i?))) 

(b) S 
< B 

- 35 

where (a) follows from the fact that keys used in s'th superblock are generated in s — I'th superblock, and (&) 
follows due to the definitions of Ei{s, h) and E2{s, h). Therefore, f{E{s, b, S)\Os„^{s, b, R)) < S. Finally, 

¥{E{s, b, <5)iaec(s, b, R, 5)) = P(0e„c(s, b, i?)|a.sec(s, &, R, S))¥{E{s, b, <5)|(5enc(s, b, R)) 

+ P(Oenc(s, b, i?)|aec(s, b, R, d))F{Eis, b, 5)|Oenc(s, 6, R)) 

< P(Oenc(s, b, i?)|asec(s, 6, i?, ,5)) + P(i;(s, 6, (5)|ae„c(s, 6, R)) 

< s 

where the last inequality follows from the fact that F{Oenc{s,b, R)\Ossc{s,b, R,6)) ~ 0. This concludes the 
achievability. Now, we prove the converse. Consider a power allocation function P(s, 6), which satisfies the average 
power constraint 

S B 

lim sup — ^ ^ P{s, b) < (57) 
s.B^^ SBfrit^, 

Let (5 > 0. It follows from the converse proof of ergodic secrecy capacity lU, and law of large numbers that 
3Bi, Ni such that for every 5", B > Bi, and N > Ni, the time-average equivocation ratj^ is bounded as 

s=l b=l 

SB 

<limsupVV— i?,(s,6)+5 (58) 
If i? is an e achievable rate, then 3^2, ^2 such that \fB > B2,N > N2 

S B 



SBN 



E E - ^)l(^-c(s, 6, R, S)) 



1 6=1 

S B 



SB 

s=l b=l 

> (R - S)il - e - S) (59) 



^For any reliable code that yields vanishing probability of error as S, B , N 00. 
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where (a) follows directly from the definition of the event C)sec(s, 6, R, S) = {H{W{s, 6)|Z'^^, h"^^) > R - S} Ci 
{-^/(X(s, b); Y(.s, bj) > i?}, and (b) follows from applying the secrecy outage constraint (|4]i, and the law of large 
numbers. 

From dSSl l, ( l59l l. it follows that any e-achievable rate R satisfies 




Since secrecy outage probability has to be satisfied (|4]i, for (s, b), s ^ 1 channel outage probabiUty also has to be 
satisfied, i.e., P{Och{s,b, R)) < e, which implies 

F{R,nis,b) < R*) < e (61) 

Since Rm{s, b) and Rs{s, b) are both deterministic functions of the power P(s, b) and instantaneous channel gains 
h(s, b), it follows that the power allocation function that maximizes R* under the constraints ( fSTl i. ( l6Tl l is a stationary 
function of instantaneous channel gains h(s, b). Interchanging the notations P(s, b) = -P(h), i?s(s, 6) = i?s(h, P) 
and Rm{s,b) = R„i{h,P), we can see that for any e achievable secrecy rate, the constraints dT)-® are satisfied, 
which completes the proof. 

Appendix B 
Proof of Theorem[2] 

The proof is very similar to the proof for full CSI, hence we only point out the differences. For full CSI, key 
generation occurs at the end of every block, using privacy amplification. Due to lack of eavesdropper channel state 
at the legitimate nodes, this is no longer possible. However, as shown in |l4l, it is still possible to generate secret 
key bits over a superblock. The following lemma replaces Lemma |9] in the full CSI case. 

Lemma 10: Let us define Wx{s) = {Wx{s,b)}^^^, where 

{[Wsec{s,b) W^i{s,b)], Of,nc{s,b,R) does not occur 
[W,2{s,b)], 0,n,{s,b,R) occurs 

and similarly define Wx{s)- There exists A^2 > 0, Bi > such that, ViV > N2, B > Bi, and for any superblock s, 
the transmitter and receiver can generate secret key bits V{s) = G{Wx{s)) and V{s) = G{[Wx{s)) respectively, 
such that V{s) = V{s) if none of the error events {Ei{s, i G {1, 2} occur, and 

H{V{s)) = NB{E[R,, (H, P)] - 6) (62) 
^I{V{s);Z^^,h''^,G)<S (63) 

The proof is very similar to the proof of Lemma |9] and is omitted here. Following the same equivocation and error 
analysis in the full CSI case, we can see that any rate R < E[i?s(H, P)]/(l — e) is achievable. The converse proof 
is also the same as in full CSI case, and is omitted here. 
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Appendix C 
Proofs in SECTioN nv-AI 

A. Proof of Lemma Q] 

The parameter i?inax is the maximum value for which the problem (|2T1 |-(|23]| has a solution; hence the average 
power constraint (l22l i is active. Moreover, the outage constraint ( |23] | is also active, and due to the fact that i?rn(h, P) 
is a concave increasing function of -P(h), we have P(i?m(H, i?max) = ^max) = (1 ^ e)> since otherwise one can 
further increase i?max to find a power allocation function that satisfies the equality. Since for a given h, the power 
allocation function that yields i?niax is Pinv(h, i?max), we have 

-^avg / -^inv (^1 -^max 
JheK 

where /C the set of channel gains for which the system operates at rate -Rmax, and P(H G /C) = (1 — e). The set 
K. contains channel gains h for which Pinv(h, i?rnax) takes minimum values, so that the average power constraint 
is satisfied for the maximum possible R. Since Pinv(h, P) ~ ^jf^ is a decreasing function of ft,,„, one can see 
that the choice of /C that yields i?max is /C = {h : hm > c}. Since the probability density function of H is well 
defined, P(-ff,„ = 0) = 0, hence c > 0, which, along with Pavg > 0, implies that i?niax > 0. 

B. Proof of Lemma \3\ 

Let i?niax > R > R' > 0. Then, any P(h) that satisfies P(i?m(H, P) < i?) < e, would also satisfy 
P(i?m(H, P) < R') < e. So, the set of power allocation functions that satisfy (|23] | shrinks as R increases, 
hence E[Ps(H,P^)] is a non-increasing function of R. Now, we prove that E[Ps(H, P^)] is continuous. From 
Lemma |2] we know that 

P^(h) = Pwf(h, \r) + l(h G GiXn. fcfl))(P,„v(h, R') - P„f(h, Xr))+ 
P^'(h) = Pwf(h,Ai^O + l(h G g{XR,,kR,)){n„,{h,R')-P^f{h, Xr,))+ 

where {XR,kR) and (Ai?',fcfl') are constants that satisfy ( fT9] l and (|20] | with equality with respect to parameters R 
and R', respectively. Let us define another power allocation function (h) such that 

P^'(h) = P„f(h, Xr) + l(h G g{XR, fcH))(finv(h, R') - Pwf(h, A,^))+ 

It is easy to see that E[P,(H, P^')] < E[P^(H, P^')]. Combining the facts i) for any h, Pinv(h, R) IS a contmuous 
function of R ii) Rs (h, P) is a continuous function of P iii) integration preserves continuity, we can see that 
/Ps(h,Pi^) — Ps(h, Pj^)l(h G Q{XR,kR))f{h)dh is a continuous function of R'. Hence, for any 7 > 0, one 
can find a S > such that for any R' < R, \R' - P| < S, 

E[P,(H,P^)] -E[i?«(H,P^')] <E[P,(H,P^)] -E[P,(H,P^')] (64) 

< I P,(h,Pifj-P,(h,Pif;)l(hG^(A^,M)/(h)dh 

<7 
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which proves that E[i?s(H,P^)] is a left continuous function of R. Following a similar approach, it can also be 
shown that E[i?s(H,P^)] is continuous from the right. 

C. Proof of Lemma |4] 

If E[i^,(H,P^)]|i^=o = 0, then the unique solution of i? = E[i?s(H, P^)]/(l - e) is i? = 0. So, consider 
E[P^(H, P^)]|i?=o = 0. It is easy to see that, < (1 - e), since 

E[i?,(H,P«— )] = / P,(h,P)/(h)dh 
<P™(h,P)(l-e) 

follows from definition of parameter c, and the inequality Ps(h, P) < Pm(h, P). Combining the facts that, 
the function )] continuous and strictly decreasing on (0,Pniax], linii?^o+ ^^^'^^-^ )1 oo and 

^[Rs(ti,P )| <^ (1 — e), by the intermediate value theorem, there exists a unique P > 0, which satisfies 

P = E[P,(H,P«)]/(l-e). 

Appendix D 
Proof of Lemma|2] 

We use Lagrangian optimization approach to find P^(h). We can express E[Ps(H, P^)] given in (l2ni-(l23Tl as 

max J(P(H)) 
p(h).e 

s.t P„(h,P) > P, Vhee 

P(H e e;) = 1 - e (65) 
where the Lagrangian J(P(H)) is given by the equatior|^ 

J(P(H)) = I Rs{h,P)f{h)dh 

- A 



J P(h)/(h)dh - P,, 



(66) 



Here, ^ is a set which consists of h for which P,„ (h, P) > R must be satisfied. We will show in this proof that 
it is of the form (fT6] l. This problem is identical to ( 1211 1. since their constraint sets are identical. Hence solution of 
this problem would also yield P^ (h). In the following two-step approach, we proceed to find P^(h). Let us fix 
A > 0. 

1) For any Q C [0, oo) x [0, oo), we find Pg(h), which is defined as 

Pg(h) = argmaxJ(P(H)) 
p(h) 

s.t P™(h,P) > P,Vh G a (67) 

^Note that we leave the constraint Mi) as is, and not include it in J(P(H)). 
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2) Using the result of part 1, we find P^(h), by finding the set Q that maximizes J'(P(H)), subject to a constraint 
P(H 6 = 1 - e. 

We start with step 1. Since both A and R are fixed, therefore we drop them from Pinv(') and Pwf(')' the following 
parts to simplify the notation. 

Lemma 11: If the problem ( l67l ) has a feasible solution, then it could be expressed as 

Pg(h) = Pwf(h) + [Pi„v(h) - Pwf(h)] + l(h e 5) (68) 

where Pwf(h) and Pinv(h) are given in ( fTSl l and ( fT4] i. respectively. 

Proof: We will interchangeably use h = [hm K]. Due to -Rm(h, P) = log(l + P(h)/i™) > P, Vh e t/. 
Hence, there is a minimum power constraint for set Q, as 

P(h) > P,„v (h) = "^-—^ , Vh e a (69) 

Define K. as the set in which the minimum power constraint ( |69] l is not active, i.e., 

/C = {hea:P(h) >P„v(h)}ue 

where ^ is complement of Q. First, we focus on the solution in the nonboundary set. Since the optimal solution 
must satisfy the Euler-Lagrange equations, 

dJ(P(h)) 



dP{h) 

For h G /C, we get the following condition 



0,h e /C 



1 + /i™P(h) 1 + /leP(h) 

whose solution yields 

1 



-A = 



P(h) 



1 4/1 1\ f I 1 



If for some h G /C, the value P(h) is negative, then due to the concavity of J(P(h)) with respect to P(h), the 
optimal value of P(h) is zero |j4]. Therefore, the solution yields 

P(h) = Pwf(h), Vh e /C (70) 

Combining the result with the minimum power constraint inside set Q, the solution of (|67] | yields ( l68T l, which 
concludes the proof. ■ 
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Now, we find P^{h). We proceed by further simplifying the Lagrangian in ( |66l ), for the case where P(h) = Pg{h), 
for a given Q as follows. 

J(Fg(H)) = / [RsiKP) - XP{h)] /(h)dh 

Jheg 

+ f [i?,(h,P)-AP(h)]/(h)dh 
= J [i?.(h, Pwf) - APwf(h)] /(h)dh 

- A [P,„v(h) - Fwf(h)] + } /(h)dh (71) 

After this simplification, the first term in ( TTTT i does not depend on Q. We conclude the proof by showing that 
P^{h) ~ Pg*(h) where the set Q* is defined as follows, 

g* = [h: [R,(h, Finv) - Rs{h, Fwf)]+ - A [Fi„v(h) - Fwf(h)]+ > fc} (72) 

where the parameter fc is a constant that satisfies P(H G Q*) ~ (1 — e). We prove this by contradiction. First 
define ^(h) = [i?,(h, Pinv) - Rs{h, -Pwf)]^ - A [Pinv(h) - Pwf(h)] + . Then, it follows from ^ that G* is the set 
that maximize ( fTTT i. so 

= argmax / ^(h)/(h)dh 
Assume that some other Q' ^ Q* is optimal, where P(H G t?') = 1 — e. However, we have 

J(Pe.(H))- J(Pc;.(H)) 

= / e(h)/(h)dh- / e(h)/(h)dh 

= / ^(h)/(h)dh - / e(h)/(h)dh 

Jg'\g' 

> (73) 

since 

/ /(h)dh= / /(h)dh 

Jg'\g- 

and 

e(h)|hee* >e(h)|hee', Vh 

by definition. This contradicts our assumption that Q' is optimal. Note that, Q* is identical to (fTTj l. This concludes 
the proof. 
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Appendix E 
Proof of Lemma |5] 

The proof goes along similar lines as in Appendix |D] so we skip the details here. We solve the problem for a 
fixed A > 0. First, for any given Q G [0, oo), we define the following problem, the solution of which yields Pg{hm)- 

Pg{h„) = arg max J{P{H„)) (74) 
subject to: R„-,,i[h.m, K],P) > i?,V/i,„ G G (75) 



Lemma 12: If the problem ( |74] | has a feasible solution, then it can be expressed as 

Pg{h,-^) - P^iK,,, A) + liKn e g) (P,nv(/i™, R) ^ P^(/l,„, A))+ (76) 

Proof: The proof uses the same approach as in proof of Lemma [TT] We define the set K such that for any 
h„i G /C, the minimum rate constraint in (iTSl l is not active. Since the optimal solution must satisfy the Euler 
Lagrange equations, we have 

dJ{P{K,)) 
dP{hm) 

If we solve the equation for any given hm, we get 

KuHHe < Kn) 



1 + h.mP(hm) Jo V 1 + heP(hm) ) 

If the power allocation function that solves the equation is negative, then by the convexity of the objective function 
m, the optimal value of P{h,n) is 0. Hence, we get P^, (h, A) as the resulting power allocation function. Whenever 
the minimum rate constraint ( |32] | is active, we get the channel inversion power allocation function, Pinv(h, i?). ■ 
Now, using Lemma [T2I we solve the following problem, 

^max^J(P(i7„)) (78) 
s.t Rm{h, P) > R, VhGe 

the solution of which yields P^{h,„). Lemma [T2l proves that the solution is a time-sharing between P„,(/i„j,A) 
and P\jp,{hm,R)- Now, we find the optimal Q. 

Lemma 13: The solution of jTSt is of the form ( f76] l, with the set Q* = [c, 00), where c is a constant which 
solves f{Hm > c) = 1 - e. 

Proof: Let Pg'{hrn) and Pg'{hrn) be the power allocation functions that are solutions of ( |76] ) given the sets 
Q* and Q', respectively. We show that, any choice of Q' ^ Q* , such that F{Hm £ G') = 1 — e is suboptimal, i.e., 

J(Pg.(i/„,))- J(Pg,(i/„0)>0 
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We continue as follows. 

JiPg,{Hm))-JiPg'{H^)) = 

[i?,([/l™,/le],Pmv) - Rsi[K^,K]^P^)]+ -X[P,Uhrn,R) - Pwf (/im, A)] + ) /(/l,„)d/l„, | f{he)dhe 



Note that, for any h'^ e and h'l^ G we have h'„^ > h','„. Since P.^{h'„^,\) > P^{h';^,\) and 

-Pinv(/lm,A) < Pinv(^J^,A), WC haVC 

[P,„v(/i:„, i?) - PM^. A)]+ < [P,„v(C R) - Pv.{h'L A)]^ 

Since Rs{-,P) is a concave increasing function of P(-) 01, and for we have '''^'^^p^^ = A. Therefore 

for any hp, we have 

M, ^inv) - Rs{[K„, K],p^)]+ - A [Pi„v(/i:„, i?) - A)]+ 

- [Rs ( [/i:; , /le] , Pinv ) - i?s ( , /le] , )] ^ + A [P^h'L , R) - Pn, [k':^ , X)]^ > ^ 

Combining this result with the packing arguments following ( |72l ) in Appendix iDl we get 

J{Pg,{H,n))- J{Pg'{H„,))>Q 
hence concluding the proof. Note that, this result can also be proved using the arguments of Section 4 in ifTSll . ■ 

Appendix F 
Proofs in SectionIv] 

A. Proof of Lemma |6| 

Due to Theorem 1.2 of Section VI in ifTTl . it suffices to show that Qnit) is a positive recurrent regenerative 
process. Note that QM{t) is a Markov process with an uncountable state space [0 M], since QM{t) can be 
written as Quit + 1) = min(7\/, QmI^) + Rsit) - l((5x(i) n (5key(t))) where Rs{t) and d^{t) are i.i.d., and 
Okey{t) = {QA/(i) + Ps(i) — -R > O} depends only on QAi{t) and Rs{t). Therefore, Qnit + 1) is independent of 
{(9A/(*)}i=i given Qhiit), hence Markovity follows. Now, we prove that QM{t) is a recurrent regenerative process 
where regeneration occurs at times ti,t2, - ' ' such that Quiti) — M. A sufficient condition for this is to show that 
Qhiit) has an accessible atom ||20l . 

Definition 4: An accessible atom M is a state that is hit with positive probabihty starting from any state, i.e., 
Et=iP(QAfW = M\Qm{1) = > Vz. 

Lemma 14: Quit) has an accessible atom M. 
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Proof: Assume QmCI) = i, i E [0,M]. Note that, Rs{t) and 0^{t) are both i.i.d. Also note that, P[Rs{t) - 
i?l(Ox(t)) > 0) > Vt|i Find 7 > such that F{Rs{t) - Rl{0^{t)) > 7) = 7 Vt. Let rj, =^ \^^■ Then, 

Vi 

nQAiirn + 1) = a/|Qa/(i) = > l[P{Rs{t) + > 6) 

f=l 

> i^' 

> 



Since Qni^) is a regenerative process, we know that t2 — ti,<3 — t2, • • • are i.i.d. random variables. Define a 
random variable r, with distribution identical to — t^. Now we show that QM{t) is positive recurrent, by 
showing E[t] < 00. Consider another recursion 

Qnit + 1) = mill {M, Q'j^jit) + R,{t) - Rl{d,{t)))^ (79) 

with Q']^j{l) = Qj\/(1). It is clear that Q']^j{t) is also regenerative, where regeneration occurs at {t'^}, where 
QAiit'i) = M, and let r' be equal in distribution to t'^^i — i^. 
Lemma 15: 

E[r] < E[r'] 

Proof: It suffices to show that when Quit) ^ M, Q'f^j{t) < QAi{t). By induction, assuming Q\,j{t) < Qnit), 
we need to verify that + 1) < Quit + 1). Consider (9A/(t + 1) < M. Then, 

Quit + 1) = (QM(t) + - n akey(t))^ 

> {Qmit) + Rs{t) - Rl{d,{t)))^ 

> {Q',j{t)+R,{t)~Rl{d,it)))^ 

■ 

Note that Q'j^[{t) is regenerative both at states and Al. Let E[t{] denote the expected time for the process Q']^j{t) 
to hit from M, and E[t2] denote the expected time to hit M from 0. Then, 

E[t'] <EK]+E[r^] (80) 

Since the key queue has a negative drift, i.e., fiR = E[i?s(H, P) - Rl{Ox{t))] < 0, it is clear that E[t{] < 00. Now, 
we show that Elr^] < 00. Following the approach of Lemma[T4l find 7 > such that P[Rs{t)-Rl{Ox{t)) > -f) ^ -f 

'since considering otherwise would lead to tlie uninteresting scenario where there are no buffer overflows (since the key queue cannot grow), 
hence any buffer size M > C'p is sufficient to achieve e' secrecy outage probability. 
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Vt. Let 1] = \AI/-fl Then, F{Qm{v + 1) = M\Qm{1) = 0) > 7'' > 0, and 

00 

E[^2]<E('? + *W^^]+^))7"(1-7T 

00 00 

< 777" - + E(l - 7")'*(IE[r(] + 7") 

i=0 1=0 

< 00 

The first inequality follows from the fact that with probability 7'', Qnit) hits M at ?/'th block and with probability 
(1 — 7''), key queue goes back to state at (IE[r{] + 7'')'th block (on average). The last inequality follows from 
< 7'' < 1, and ratio test. This result, along with dSOb and Lemma [T5] concludes that Quit) is a positive recurrent 
regenerative process, which concludes the proof. 

B. Proof of Lemma [7| 

We follow an indirect approach to prove the lemma. Let denote the key queue dynamics of the same 

system for the infinite buffer case (M = cxd). First, we use the heavy traffic results in ifTSl to calculate the overflow 
probability of the infinite buffer queue. Then, we relate the overflow probability of infinite buffer system to the loss 
ratio of the finite buffer queue. The dynamics of the infinite buffer queue is characterized by 

Q(t + 1) = Q(t) + Rsit) - l(ae„c(t))i? (81) 

where Q(l) = 0. The heavy traffic results we will use are for queues that have a stationary distribution. Since it 
is not clear whether Q{t) is stationary or not, we will upper bound Q{t) by another stationary process Q'{t), and 
the buffer overflow probability result we will get for Q'{t) will serve as an upper bound for Q{t). 
Let {Q'{t)}t>i be the process that satisfies the following recursion 

Q'{t + 1) = (g'(t) + R,{t) - Rl{OS))^ (82) 

with Q'(l) = 0. First, we relate Q'{t) to Q{t). 
Lemma 16: 

Q{t) < Q'{t)+R, \/t (83) 

Proof: Assuming Q{t) < Q'{t) + R, we need to show by induction that Q{t + 1) < Q' (t + 1) + R. There are 
two different scenarios. 

1) If Q'{t) + Rs{t) - Rl {0^{t)) > 0, then, using the facts (5enc(i) = 0^{t) D d)key(t) and Q'{t) < Q{t), we 
obtain 

Q{t) + Rs{t) - Rl (ae„c(t)) > Q'{t) + R,{t) - Rl 

> 
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which, using the described key queue recursions in dST] ). impUes 

Qit + 1) = Q{t) + R,{t) - Rl {d,it)) (84) 

Observe that, by ( |82] |, 

Q'{t + l) = Q'{t)+R,{t)-Rl 

which, in conjunction with (|84]i and Q{t) < Q'{t) + R, yields Q{t + 1) < + 1) + i?. 
2) If Q'(f) + i?s(t)-i?l ((Dx(t)) < 0, then Q'{t + l) = 0. We further consider two cases. First, \f Q{t) + R,{t) - 
i? > 0, then, 

Q{t + 1) = (Q(t) + Rs{t) - Rl )^ 

< {Q'{t)+R + Rs{t)~Rl {0,it))y <R 

^Q'{t + 1)+R (85) 
Next, if Q{t) + Rs{t) - R < 0, then 

Q{t + 1) g(t) + Rsit) < i? = Q'(i + 1) + i? 
which, combined with dSST l. yields 

Q(t + i) <g'(i + i) + i? 

■ 

Now, we show that Q'{t) converges in distribution to an almost surely finite random variable Q'. First, we need to 
show that the expected drift of Q'{t) is negative. It is clear from ( |82] | that the expected drift of the process Q'{t) 
is equal to hr = E[i?s(H,P^)] - R{1 - e). 

Lemma 17: For R > Cp, we have fiji < 0, and fin is a continuous decreasing function of R. 

Proof: From Lemma |3] in Section HV-AI we know that E[Rs{ll, P^)] is a non-increasing continuous function 
of R. Therefore, ^r it is a continuous function of R. Furthermore, by definition of Cp in (|7]i, fic^ = 0. Combining 
these two facts, we conclude that /i^ < 0, for R > Cp. ■ 

Lemma 18: There exists an almost surely finite random variable Q' such that, for all x, 

limsupP(g(t) > x) < P(g' + R> x) (86) 

Proof: Combining Lemma [Tt] with the classic results by Loynes [16), we can see that Q'{t) converges in 
distribution to an almost surely finite random variable Q' such that 

lim P(g'(i) > x) = p(g' > x) 

t— s-oo 

Using ( [83] ), we finish the proof of the lemma. ■ 
Now, we characterize the tail distribution of the key queue. 
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Lemma 19: For any given AI > 0, 



Proof: First, we prove that 

lini pf^^>y^ =e-2^ (88) 

which is based on the heavy traffic Umit for queues developed in fTSl , see also Theorem 7.1 in ifTTl . In order to 
prove (ISST l. we only need to verify the following three conditions: i) lim^x^cj, A*/? =0; ii) limijx^c'i^ > 0; and 
iii) the set |(i?s(H, P^) — i?l((5x(^)))^| of random variables indexed by R is uniformly integrable. 

i) From Lemma [TtI we obtain limijN^c*!^ fiji = 0. 

ii) Since i?s(H,P*) — CpOx{t) is not a constant random variable, almost surely 

lim^ (t| = Yar[Rs{U, P*) - C|.((5x(t))] > 

iii) Note that, R lies on the interval [0 -Rmax], where -Rmax, defined in Lemma [T] then we have 

(i?,(H,P^) =i?.(H,P^)2 - 2i?,,(H,F«)i?l (OxW) + 

R^i 

Since i?s(h, P) is a continuous function of P(h), and for any P on the interval [0 Pmax], limc_>oo IP(-P^(H) > 
c) — 0, hence we can see that limc^oo ]P(^s(H, P''^) > c) = 0. Therefore, this class of random variables is 
uniformly integrable. This completes the proof of dSSl l. This result, in conjunction with Lemma [TS] completes the 
proof. ■ 
Using Lemma 1 in 1191 , we relate the loss ratio of our finite buffer queue Quit) to the overflow probability of 
the infinite buffer queue Q{t) as follows 

/•oo 

E[Ps(H,P^)]limsupL'^(Af) < / \imsup¥{Q{t) > x)dx (89) 

T— >oo J x=M t—iroa 

Combining Lemma [19] with (|89] l. the proof is complete. 

References 

[1] C. E. Shannon, "Communication Theory of Secrecy Systems," The Bell System Technical Journal, vol. 28, pp. 656-715, October 1949. 
[2] A. D. Wyner, "The Wire-Tap Channel," The Bell System Technical Journal, vol. 54, no. 8, pp. 1355-1387, October 1975. 
[3] S. Leung- Yan-Cheong and M. Hellman, "The Gaussian Wire-Tap Channel," IEEE Transactions on Information Theory , vol.24, no. 4, pp. 
451-456, Jul 1978 

[4] P. K. Gopala, L. Lai, and H. El-Gamal, "On the Secrecy Capacity of Fading Channels," IEEE Transactions on Information Theory, vol.54, 

no.lO, pp.4687-4698, October 2008. 
[5] Y. Abdallah, M. A. Latif. M. Youssef. A. Sultan and H. El-Gamal, "Keys through ARQ: Theory and Practice," arXiv: I005.5063v2 [cs.IT], 

May 2010. 

[6] M. Bloch, J. Barros, M.R.D. Rodrigues, and S.W. McLaughlin, "Wireless Information-Theoretic Security," IEEE Transactions on 
Information Theory, vol.54, pp. 2515-2534, 2008 



December 14, 2011 



DRAFT 



32 



[7] A. Khisti, A. Tchamkerten and G.W. Wornell /'Secure Broadcasting Over Fading Channels," IEEE Transactions on Information Theory, 

vol.54, no.6, pp.2453-2469, June 2008 
[8] Y. Liang, H.V. Poor and S. Shamai, "Secure Communication Over Fading Channels," IEEE Transactions on Information Theory, vol.54, 

no.6, pp.2470-2492, June 2008 

[9] C.H. Bennett, G. Brassard, C. Crepeau, and U.M. Maurer, "Generalized Privacy Amplification," IEEE Transactions on Information Theory 

, vol.41, no.6, pp.1915-1923, Nov 1995. 
[10] U. Maurer and S. Wolf, "Information-Theoretic Key Agreement: From Weak to Strong Secrecy for Free," Advances in Cryptology - 

EURO-CRYPT 2000, Lecture Notes in Computer Science 1807, pp.35 1-368, 2000. 
[11] A.C.A. Nascimento, J. Barros, S. Skludarek, and H. Imai, "The Commitment Capacity of the Gaussian Channel Is Infinite," IEEE 

Transactions on Information Theory, vol.54, no.6, pp. 2785-2789, June 2008 
[12] R. G. Gallager, "A Simple Derivation of the Coding Theorem and Some Applications," IEEE Transactions on Information Theory, vol. 

IT-11, pp. 3-18, Januaiy 1965. 
[13] T. Cover and J. Thomas, "Elements of Information Theory,". John Wiley & Sons, 1991. 

[14] K. Khalil, M. Youssef, O. O. Koyluoglu, and H. El-Gamal, "Opportunistic Secrecy with a Strict Delay Constraint," arXiv:0907.334IvI 
[cs.IT], Jul 2009. 

[15] J. Luo, L. Lin, R. Yates, and P. Spasojevic, "Service Outage Based Power and Rate Allocation," IEEE Transactions on Information Theory 

, vol.49, no.l, pp. 323-330, January 2003. 
[16] R. M. Loynes. The stability of a queue with non-independent inter-aiTival and service times. Mathematical Proceedings of the Cambridge 

Philosophical Society, 58:497-520, 1962. 
[17] S. Asmussen, Applied Probability and Queues. Wiley, New York, 1987. 

[18] J. F. C. Kingman, "On Queues in Heavy Traffic," Journal of the Royal Statistical Society. Series B (Methodological), vol.24, no. 2, 
pp.383-392, 1962. 

[19] H. S. Kim and N. B. Shioff, "On the Asymptotic Relationship Between the Overflow Probability in an Infinite Queue and the Loss 
Probability in a Finite Queue," Advances in Applied Probability, Vol. 33, No. 4, pp. 836-863, Dec. 2001. 

[20] P. Bertail and S. Clemengon, "A Renewal Approach to Markovian U-statistics," Mathematical Methods of Statistics, Vol. 20, No. 2, pp. 
79-105, June 2011 



December 14, 2011 



DRAFT 



